Re: MDAC Patch Installation Mystery

From: John Groth (johng_at_PURDUE.EDU)
Date: 01/16/04

  • Next message: Knight, Jim: "MS04-001" 
    Date:         Thu, 15 Jan 2004 21:06:19 -0500
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    I wrote a reply to a similar message earlier today and I think it may
    help you out. I've inlined the reply and also added some more comments:

    the latest MDAC patch, noted in MS04-003, does not support MDAC 2.6.
    you need to upgrade to a supported version. To stay at the same MDAC
    level it is suggested you install 2.6 SP2.

    as Russ noted in his mdac message, this patch uses dahotfix.exe patch
    installer. It will write to a log file in your %systemroot%. You can
    check this file out. Notice the installer starting. It will run the
    "CheckMdacversion" functions first to determine what version of MDAC you
    are running. Since 2.6 & 2.6 SP1 aren't supported this check will fail.
      The installer will then fail updating the vulnerable files and exit.

    This is a hunch:

    Windows update probably ran the patch installer with silent flags. But
    it errored out because it couldn't detect your MDAC version because your
    version is no longer supported. Windows Update doesn't do a great job of
    figuring out versions of MDAC and issued you this patch when it
    shouldn't have done so. I had this happen to one of my workstations
    that was MDAC 2.6 SP1 on the last MDAC patch, noted in MS03-033.
    I downloaded the patch manually and installed it with NO flags. You
    will agree to the EULA and it proceeds to patch the machine. the
    dahotfix.exe installer will fail during the check mdac version routine.
      It logs it to %systemroot%\dahotfix.log and exits the installation
    process. I think then you might see a dialog box that says there was a
    problem installing the patch please contact Product Support Services.
    At which point you do that and they figure out you are running an
    outdated version of MDAC that the dahotfix.exe installer doesn't support...

    inlined reply to similar message from earlier today:
    > The information on that site is not helpful in this situation.
    > That site outlines switches for installations of mdac via the MDAC_TYPE.EXE's used to install MDAC. "dasetup.exe"
    >
    > According to the MS04-003 security bulletin on the technet site,
    > you should use the following for a silent install with no dialogs and no reboot:
    >
    > /C:"dahotfix.exe /q /n" /q
    >
    > the last /Q suppresses dialogs for the patch installer
    > the "dahotfix.exe /q" suppresses dialogs for the internal hotfix installer. the "/n" tells dahotfix.exe to not reboot.
    >
    > the /C: gives you access to override the patch's default commands.
    > use google or microsoft's knowledge base to search for many of these
    > undocumented switches. try searching for "dahotfix.exe" to get started.
    >
    > also, for the original poster. MDAC 2.6 is only supported for the SP2 version. To apply this patch you need to upgrade your MDAC first.
    > The MDAC component checker tool is nice. If you want to reassure yourself you can check the registry key for MDAC version here:
    >
    > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DataAccess\Version
    >
    > see where it falls in this list:
    > MDAC Version FullInstallVer
    > MDAC 2.5 RTM 2.50.xxxx.x
    > MDAC 2.5 SP1 2.51.xxxx.x
    > MDAC 2.5 SP2 2.52.xxxx.x
    > MDAC 2.5 SP3 2.53.xxxx.x
    > MDAC 2.6 RTM 2.60.xxxx.x
    > MDAC 2.6 SP1 2.61.xxxx.x
    > MDAC 2.6 SP2 2.62.xxxx.x
    > MDAC 2.7 RTM 2.70.xxxx.x
    > MDAC 2.7 SP1 2.71.xxxx.x
    > MDAC 2.8 RTM 2.80.xxxx.x
    >
    > Cheers >=]
    > ~johng
    >
    > sources:
    > MS04-003 bulletin
    > http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS04-003.asp
    >
    > Various KB articles
    > http://support.microsoft.com/default.aspx?kbid=301202
    > http://support.microsoft.com/default.aspx?scid=kb;en-us;823718
    >
    > google is your friend
    > http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=utf-8&q=dahotfix.exe+switches&btnG=Google+Search

    Manskopf, Michael wrote:
    > Just installed the MDAC patch (Q832483) on my Windows 2000 SP4 workstation
    > for testing, since Windows Update notified me to apply it two days ago. It
    > installed, but did not request a reboot. I manually rebooted anyway. When my
    > workstation restarted, I checked the registry for the MDAC patch key:
    > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\DataAccess\Q832483. It's not
    > there. In fact, I did a search of my entire registry, and no mention of the
    > patch anywhere. I next checked my versions of the MDAC files "odbcbcp.dll"
    > and "adbc32.dll". Odbcbcp.dll is at version 2000.80.380.0 and Odbc32.dll is
    > at version 3.520.7326.0. I also ran the MDAC Component Checker Tool
    > (http://www.microsoft.com/downloads/details.aspx?FamilyId=8F0A8DF6-4A21-4B43
    > -BF53-14332EF092C9&displaylang=en
    > <http://www.microsoft.com/downloads/details.aspx?FamilyId=8F0A8DF6-4A21-4B43
    > -BF53-14332EF092C9&displaylang=en> ) which told me I have MDAC version 2.6
    > SP1. The prerequisite for this patch for MDAC version 2.6 is SP2, so the
    > patch, apparently, didn't apply, even though Windows Update told me it
    > applied to my version and that it installed.
    > Anyone else have this problem?
    >
    >
    > Michael Manskopf
    > INFORMATION TECHNOLOGY
    > CANACCORD CAPITAL CORP.
    > #2200 - 609 Granville Street,
    > Vancouver, B.C.
    > V7Y 1H2
    > EMAIL: <mailto:Michael_Manskopf@canaccord.com
    > <mailto:Michael_Manskopf@canaccord.com> > 

    --
John Groth
Web/Systems Specialist
Purdue Marketing Communications
Military Family Research Institute
johng at purdue dot edu
765.423.2266 ext 209
-0500 gmt
-----
Editor's Note: The 43rd Most Powerful Person in Networking says...
Marcus Ranum's new book "The Myth of Homeland Security" is now out and is available from http://www.amazon.com/ranum In this hard-hitting review of the homeland security business, Ranum shows us how the problem is vastly harder than it's being made to sound, and how special interests, *** covering, and bureaucracy are threatening to derail any chance of making progress.
-----
  • Next message: Knight, Jim: "MS04-001"